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DETAILED ACTION 
Response to Arguments 

1 . Applicant's arguments filed 9/22/2008 have been fully considered but they are 
not persuasive. 

2. Applicant's arguments begin by addressing Sorhaug, arguing that Sorhaug's 
teaching "the system monitor or network analyzer can selectively insert data in either 
direction to provide complete diagnostic testing of the channel" does not support the 
"both the options of inserting data either disruptively or non-disruptively". However, the 
Examiner has not argued that this is the case; that is, the Examiner has not argued that 
this statement alone supports all of "both the options of inserting data either disruptively 
or non-disruptively". 

3. To teach "at least one of the first and second tap ports configured to receive 
device data from the attached device, means for inserting device data from the 
attached device into the network cable without disrupting the flow of data therein", 
multiple sections of Sorhaug were cited. Furthermore, when responding to Applicant's 
previous argument (6/20/2008), the Examiner also discussed addition citations from 
Sorhaug. Applicant has only addressed one of the citations. 

4. Sorhaug's teachings of: 

I. "the medium monitor may interrupt medium data transfer in either 
direction and insert its data for diagnostic or other network purposes" 
(Abstract, emphasis added) 
and Sorhaug's teaching of 
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II. "the network monitor or medium analyzer can selectively insert data in 
either direction to provide complete diagnostic control testing of the 
channel." 

(col. 2 lines 12 -14) 

show that Sorhaug has anticipated both disruptive interruption of traffic for diagnostics 
in citation I above, but notes that it may occur, not that it must; citation II describes 
selective insertion of data and without discussing any data disruption. Thus, given that 
there are inherently only two options for data insertions (disruptively or non-disruptively), 
since Sorhaug discloses both options, it would have been obvious to one of ordinary 
skill in the art at the time of the invention to insert data and not disrupt the data flow. 
Applicant's arguments thus are not persuasive. 

5. Applicant next provides their own interpretative summaries of Sorhaug's 
teaching, and argues that "these teaches of Sorhaug . . . teaches away from 'means for 
inserting device data from the attached device into the network cable without disrupting 
the flow of data therein'". However, the Examiner does not agree with this argument. 
Sorhaug's teachings show the option of disruptive data insertion, but also, for the 
reasons given above, inserting data without disrupting data flow. Applicant's arguments 
thus are not persuasive. 

6. Applicant next provides a summary of col. 3 lines 1 1 - 21 of Sorhaug, and then 
argues that Sorhaug's teachings "cannot transmit . . . data without . . . disrupt[ing] data 
from the device" and that Sorhaug does not teach "means for inserting device data from 
the attached device". However, the Examiner does not agree that col. 3 lines 1 1 - 21 
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support Applicant's conclusions and interpretations of Sorhaug; Applicant's arguments 
regarding Sorhaug's teaching inserting device data without disrupting data flow continue 
to be unpersuasive due to the reasons given above. 

7. Applicant next discusses their interpretation of claim 1 , and then argues that in 
Yanacek, "there is no teaching or suggestion of inserting device data from an attached 
device into the network cable". Applicant continues with this argument on pages 15-17, 
regarding Applicant's belief that Yanacek does not teach "network data and device data" 
and "receiving device data". However, Yanacek was not cited to teach the language in 
claim 1 that Applicant is addressing, "receive data from the attached device". Sorhaug 
was cited to teach this limitation, and thus Applicant's argument is not persuasive. 

8. Worrall in view of Sorhaug, as described in the previous and pending rejections, 
were cited to teach network and device data; Yanacek was cited to teach turning 
tapping on and off. 

9. As was noted in the previous Office Action (6/20/2008), Yanacek clearly teaches 
turning the tap on and off (Fig. 2, col. 1 lines 1-10, col. 4 lines 5-10, lines 50 - 55 and 
col. 5 lines 53 - 56). Turning said tap off, and preventing it from tapping and would thus 
preventing it from receiving all data; not receiving any data includes both network and 
device data (where said device data is data sent between the two tapped devices). 

1 0. Applicant also argues that "claim 1 recites that the device data by the first and 
second ports can be inserted back into the network cable." However, this language is 
not in claim 1 , and thus Applicant's argument is not persuasive. 
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Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the phor art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary sl^ill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

2. Claims 1 -13, 15, 16,17,19 - 24, 26, 27, 29, 30 and 31 are rejected under 35 
U.S.C. 1 03(a) as being unpatentable over Worrall et al. (US 2006/01 531 77 A1 ), 
hereafter Worrall, in view of in view of Sorhaug et al. (US 6,424,627 B1 ), hereafter 
Sorhaug, further in view of Yanacek et al. (5,940,376), hereafter Yanacek. 

3. Regarding claim 1 , Worrall shows a network tap that permits an attached device 
to communicate with a node of a network, the node of the network communicating with 
a network cable transmitting network data thereon, the network cable having a first 
segment and a second segment, the network tap comprising: a first and second tap 
port, at least one of which is configured to receive a copy of network data obtained from 
the network cable, wherein the attached device can be selectively connected to at least 
one of the first and second tap ports (Abstract, Figs. 1A-1C, Figs 4 and 5, [0023-0029]). 

Worrall does not show at least one of the first and second tap ports configured to 
receive device data from the attached device, the first and second tap ports being 
capable of operating in a plurality of modes, each being defined by enabling or disabling 
the ability of the first and second tap ports to receive network data and device data; 
means for inserting device data from the attached device into the network cable without 
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disrupting the flow of data therein; and means for selecting one of the plurality of modes 
in which the first and second tap ports may operate. 

Sorhaug shows at least one of the first and second tap ports configured to 
receive device data from the attached device, means for inserting device data from the 
attached device into the network cable without disrupting the flow of data therein. 
(Sorhaug, col. 2 lines 1 - 22, col. 2 lines 40 - 65, col. 3 lines 10 - 45). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrall with that of Sorhaug in order to allow for 
more control of the network tap apparatus, and how the data in said network tap system 
was handled in order to enable more options for configuration and use as well as to 
monitor data at maximum data rates while providing not significant network data delay 
(Sorhaug, Abstract, col. 1 line 40 - col. 2 line 10). 

Worrall in view of Sorhaug do not show the first and second tap ports being 
capable of operating in a plurality of modes, each being defined by enabling or disabling 
the ability of the first and second tap ports to receive network data and device data; and 
means for selecting one of the plurality of modes in which the first and second tap ports 
may operate. 

Yanacek shows the first and second tap ports being capable of operating in a 
plurality of modes, each being defined by enabling or disabling the ability of the first and 
second tap ports to receive network data and device data; and means for selecting one 
of the plurality of modes in which the first and second tap ports may operate (Fig. 2, col. 
1 lines 1-10, col. 4 lines 5- 10, lines 50 - 55 and col. 5 lines 53 - 56). 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrall in view of Sorhaug and NetOptics with that 
of Yanacek in order to enable and more advanced and flexible system. 

4. Regarding claim 2, Worrall in view of Sorhaug and Yanacek further show wherein 
in one mode, the first and second tap ports are both enabled to receive the network 
data (Worrall, Figs. 1a-1c, 3a-3c; Sorhaug, Fig. 2 and col. 2 lines 5 - 65). 

5. Regarding claim 3, Worrall in view of Sorhaug and Yanacek further show wherein 
in one mode, at least one of the first and second tap ports are enabled to receive device 
data (Worrall, Figs, la-lc, 3a-3c; Sorhaug, Fig. 2 and col. 2 lines 5 - 65). 

6. Regarding claims 4 - 9, Worrall in view of Sorhaug and Yanacek further show 
wherein the first and second tap ports are capable of operating in a plurality of modes, 
each mode being defined by enabling or disabling the ability of the first and second tap 
ports to receive data (Yanacek Fig. 2, 10A - 10C), including network and device data 
(Worrall, Figs. 1a-1c, 3a-3c; Sorhaug, Fig. 2 and col. 2 lines 5 - 65). 

Worrall in view of Sorhaug and Yanacek thus disclose enabling or disabling the 
ability for each of the tap ports to receive network and device data. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to experiment and try the various permutations of on and off for both network 
and device data, as it is obvious to try choosing from a finite number of identified and 
predictable configurations. 
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7. Regarding claim 1 0, Worrail in view of Sorhaug and Yanacek further show 
wherein means for inserting received device data into the network cable without 
disrupting the flow of data therein comprises an Ethernet switch (Worrail, Fig. 1(c)). 

8. Regarding claim 1 1 , Worrail in view of Sorhaug and Yanacek further show 
wherein means for Inserting received device data into the network cable without 
disrupting the flow of data therein comprises an integrated circuit (Sorhaug, col. 2 lines 
55-56, col. 3 lines 4 5- 47). 

9. Regarding claim 1 2, Worrail in view of Sorhaug and Yanacek further show 
wherein the integrated circuit comprises a field programmable gate array (Worrail, Fig. 
4). 

1 0. Regarding claim 1 3, Worrail in view of Sorhaug and Yanacek further show 
wherein means for selecting one of the plurality of modes in which the first and second 
tap ports may operate comprises: a management port configured to selectively connect 
to a remote computer; and an integrated circuit configured to receive management data 
from the management port to at least indirectly enable or disable the ability of the first 
and second tap port to receive at least one of network data and device data (Yanacek, 
Figs. 2, 1 0A - IOC). 

1 1 . Regarding claim 1 5, Worrail in view of Sorhaug and Yanacek further show a 
network tap that permits an attached device to communicate with a node of a network, 
the node of the network communicating with a network cable transmitting network data 
thereon, the network cable having a first segment and a second segment, the network 
tap comprising: 
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a first tap port configured to receive a copy of networl< data obtained from the 
network cable (Worrall, Abstract, Figs. 1A-1C, Figs 4 and 5, [0023-0029]); 

a second tap port configured to receive a copy of network data obtained from the 
network cable, wherein the attached device can be selectively connected to at least one 
of the first tap port and second tap port (Worrall, Abstract, Figs. 1A-1C, Figs 4 and 5, 
[0023-0029]), wherein at least one of the first tap port and second tap port is configured 
to receive device data from the attached device (Sorhaug, Fig. 2, col. 2 lines 5 - 65), 
and wherein the first tap port and second tap port are configured to operate in a plurality 
of modes, each mode being defined by enabling or disabling the ability of the first tap 
port and second tap port to receive network data and device data (Yanacek, Fig. 2, 
1 0A-IOC); 

a routing node that is in communication with the first tap port and second tap 
port, the routing node being configured to pass network data from the network cable to 
at least one of the first tap port and the second tap port and to pass device data from at 
least one of the first tap port and second tap port to the network cable (Sorhaug, col. 3 
line 10 - col. 4 line 45); and 

an integrated circuit (Sorhaug, col. 2 lines 55-56, col. 31 ines 45-47) configured to 
select the mode in which the first tap port and second tap port operate (Yanacek, Figs. 
2, 1 0A -IOC). 

1 2. Regarding claims 1 6, 1 7 and 1 9 - 24, Worrall in view of Sorhaug and Yanacek 
further show wherein the first and second tap ports are capable of operating in a 
plurality of modes, each mode being defined by enabling or disabling the ability of the 
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first and second tap ports to receive data (Yanacel< Fig. 2, 10A - IOC), including 
network and device data (Worrall, Figs, la-lc, 3a-3c; Sorhaug, Fig. 2 and col. 2 lines 5 
-65). 

Worrall in view of Sorhaug and Yanacek thus disclose enabling or disabling the 
ability for each of the tap ports to receive network and device data. 

It would have been obvious to one of ordinary skill in the art at the tinne of the 
invention to experiment and try the various permutations of on and off for both network 
and device data, as it is obvious to try choosing from a finite number of identified and 
predictable configurations. 

1 3. Regarding claim 26, Worrall in view of Sorhaug and Yanacek further show a 
network tap that permits an attached device to communicate with a node of a network, 
the node of the network communicating with a network cable transmitting network data 
thereon, the network tap comprising: a first network port configured to transmit or 
receive network data; a second network port configured to transmit or receive network 
data; a first tap port configured to receive a copy of at least some of the network data 
(Worrall, Abstract, Figs. 1A-1C, Figs 4 and 5, [0023-0029]); 

a second tap port configured to receive a copy of at least some of the network 
data (Worrall, Abstract, Figs. 1A-1C, Figs 4 and 5, [0023-0029]), 

wherein an attached device can be selectively connected to at least one of the 
first tap port and second tap port (Sorhaug, Fig. 2, col. 2 lines 5 - 65), 

wherein at least one of the first tap port and second tap port is configured to 
receive device data from the attached device (Sorhaug, Fig. 2, col. 2 lines 5 - 65), and 
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wherein tlie first tap port and second tap port are configured to operate in a 
plurality of modes, each mode being defined by enabling or disabling the ability of the 
first tap port and second tap port to receive network data and device data (Yanacek, 
Fig. 2, 10A-10C); and 

a first switch (Worrall, Fig. 1(c)) that is in communication with the first network 
port and the second network port and with the first tap port and second tap port, the 
switch being configured to pass network data between the first network port and the 
second network port and transmit device data from one of the first tap port and second 
tap port to one of the first network port and second network port on the network cable 
without disrupting a flow of the network data (Sorhaug, Abstract, col. 2 lines 1 - 22, col. 
3 line 10 -col. 4 line 45). 

14. Regarding claim 27, Worrall in view of Sorhaug and Yanacek further show 
utilizing a switch that is in communication with the first network port and the second 
network port and with the first tap port and the second tap port, the switch being 
configured to combined network data from the first network port and second network 
port and transmit the combined network data to one of the first tap port and second tap 
port (Worrall, Abstract, Figs. 1A-1C, Figs 4 and 5, [0023-0029]). 

1 5. Regarding claim 29, Worrall in view of Sorhaug and Yanacek further show an 
integrated circuit configured to select the mode in which the first tap port and the second 
tap port operate (Sorhaug, col. 2 lines 55 - 56; col. 3 line 10 - col. 4 line 45) 
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16. Regarding claim 30, Worrail in view of Sorhaug and Yanacek further show 
wherein the integrated circuit comprises a Field Programmable Gate Array (Worrail, Fig. 
4). 

1 7. Regarding claim 31 , Worrail in view of Sorhaug and Yanacek further show a 

management port configured to transmit management data to the integrated circuit, the 
management port being configured to be selectively connected to a remote computer 
(Yanacek, Fig. 2, 1 0A-IOC). 

18. Claim 14 is rejected under 35 U.S.C. 103(a) as being unpatentable in view of 
Worarall in view of Sorhaug and Yanacek as applied to claims 1 and 13 above, further 
in view of Bouthillier et al. (6,092,724), hereafter Bouthillier. 

Worrail in view of Sorhaug and Yanacek enable configuring a network tap to 
operate in one of a pluarality of modes (Yanacek, Figs. 2, 10A - IOC). 

Worrail In view of Sorhaug and Yanacek do not show where this mode selection 
Is done via one or more manual switches on the network tap. 

Bouthillier shows a manual switch for changing the configuration and operating 
mode of a network device (Abstract, Fig. 1 ). 

It would have been obvious to one of ordinary skill In the art at the time of the 
Invention to modify the disclosure of Worrail in view of Sorhaug and Yanacek with that 
of Bouthillier to enable the use of manual switches to configure the electronic device as 
manual switches are well-understood, easy to operate and reliable. 

19. Claim 18 is rejected under 35 U.S.C. 103(a) as being unpatentable over Worarall 
in view of Sorhaug and Yanacek as applied to claim 15 and 17 above, and further in 
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view of Bunker et al. (US 2003/00561 16 A1), hereafter Bunker, further in view of 
Chinnock et al. (5,426,427), hereafter Chinnock. 

Worarall in view of Sorhaug and Yanacek show claims 15 and 17. 

Worarall in view of Sorhaug and Yanacek do not show where the attached device 
is an intrusion detection system; and the device data comprises a kill packet from the 
intrusion detection system, the routing node being configured for transmitting the kill 
packet via the network cable to a firewall. 

Bunker shows an intrusion detection system and where the intrusion detection 
system can block access from particular devices ([0009-0010,0150,0312-0313]). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worarall in view of Sorhaug and Yanacek with that 
of Bunker as it is a combination of prior art elements according to known methods in 
order to yield predictable results. 

Worarall in view of Sorhaug, Yanacek and Bunker do not show where said 
intrusion detection system utilizes a kill packet. 

Chinnock shows a kill packet (col. 12 lines 1 - 25). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worarall in view of Sorhaug, Yanacek and Bunker 
with that of Chinnock as it is a combination of prior art elements according to known 
methods in order to yield predictable results. 
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20. Claim 25 is rejected under 35 U.S.C. 103(a) as being unpatentable over Worarall 
in view of Sorhaug and Yanacek as applied to claim 16 above, and further in view of 
Pontis et al. (US 2004/0007526 A1), hereafter Pontis. 

Worarall in view of Sorhaug and Yanacek show a first multiplexer in 
communication with the first tap port (Yanacek, Fig. 2, 10A-10c); and a second 
multiplexer In communication with the second tap port (Yanacek, Fig. 2, 10A-10C), an 
integrated circuit (Worrall, [0024-0026]), as well as communicating with taps in order to 
configure them (Yanacek, Fig. 2, 1 0A-IOC). 

Worarall In view of Sorhaug and Yanacek do not show where said Integrated 
circuit controls the first multiplexer and second multiplexer to select the mode in which 
the first tap port and second tap port operate. 

Points shows a Field Programmable Gate Array (FPGA), which is inherently a 
type of Integrated circuit, controlling a multiplexer's mode ([0075]), thus showing where 
said integrated circuit controls the first multiplexer and second multiplexer to select the 
mode in which the first tap port and second tap port operate. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worarall in view of Sorhaug and Yanacek with that 
of Pontis as It Involves use of known techniques (using integrated circuits to control 
multiplexers) to yield predictable results. 

21 . Claim 28 is rejected under 35 U.S.C. 103(a) as being unpatentable over Worarall 
in view of Sorhaug and Yanacek as applied to claim 27 above, and further in view of 
NetOptics (4x1 GigaBit Tap). 
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Worarall in view of Sorhaug and Yanacel< sliow tap ports receiving copies of 
network data, and utilizing switches for duplicating combined network data and 
transmitting said duplicated combined data (Worrall; Abstract, Figs. 1A-1C, Figs 4 and 
5, [0023-0029]; Sorhaug, col. 2 lines 1 - 22, col. 2 lines 40 - 65, col. 3 lines 10 - 45). 

Worarall in view of Sorhaug and Yanacek do not explicitly show a third and a 
fourth tap port. 

NetOptics shows a third and a forth tap port. (pgs. 1 - 3). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrall in view of Sorhaug and Yanacek with that 
of NetOptics in order to allow for the connection of more devices, enabling more 
detailed network monitoring as well as more possible monitoring configurations. 

22. Claims 32 and 33 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Worrall in view of Sorhaug and Yanacek as applied to claim 26 above, further in 
view Tomonaga et al. (5,610,913), hereafter Tomonaga and of Gromov (US 6,975,209 
B2). 

23. Regarding claim 32, Worrall in view of Sorhaug and Yanacek show claim 26. 
Worrall in view of Sorhaug and Yanacek do not show claim 26 further comprising 

a first communication line from the first network port to the first switch and a second 
communication line from the second network port to the first switch, each of the first 
communication line and the second communication line including a fan out buffer that 
propagates the network data to the switch and propagates a copy of the network data to 
the first tap port and second tap port. 
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Tomonaga shows where multiple inputs are sent into a switch, and then a 
multiplex/dexmultiplex unti, which comprises a fan out buffer memory (Figs. 46 and 47). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrall in view of Sorhaug and NetOptics with that 
of Tomonaga in order to increase the number of devices and users that a network can 
accommodate and support (Tomonaga, col. 3 lines 57 - 67). 

Worrall in view of Sorhaug, Yanacek and Tomonaga thus show a first 
communication line from the first network port to the first switch and a second 
communication line from the second network port to the first switch, each of the first 
communication line and the second communication line including a fan out buffer that 
propagates the network data to the switch and propagates a copy of the network data to 
the first tap port and second tap port. 

Worrall in view of Sorhaug, Yanacek and Tomonaga do not show a relay for 
circumventing the first switch in the event of loss of power at the network tap and a 
transformer. 

Gromov shows a relay for circumventing the first switch in the event of loss of 
power at the network tap and a transformer (col. 7 lines 22 - 26, Figs. 2 - 4). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrall in view of Sorhaug, Yanacek and 
Tomonaga with that of Gromov as it is combining prior art elements to yield predictable 
results. 
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24. Regarding claim 33, Worrall in view of Sorhaug, Yanacek, Tomonaga and 
Gromov show comprising a third communication line for transmitting device data from 
one of the first tap port and second tap port to the first switch, the third communication 
line including: a transformer (Gromov, Figs. 2 - 4, col. 7 lines 22 - 67); a physical layer 
device (Worrall, [0024-0025], Fig. 4; Sorhaug, Fig. 2, col. 1 line 65 - col. 2 line 5); and a 
multiplexer (Worrall, Fig. 4). 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to John M. Macllwinen whose telephone number is (571 ) 

272- 9686. The examiner can normally be reached on M-F 7:30AM - 5:00PM EST; off 
alternate Fridays. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on (571) 272-3868. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 

273- 8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Andrew Caldwell/ 

Supervisory Patent Examiner, Art 

Unit 2442 

John Macllwinen 



(571)272-9686 



